CVE-2025-47256: Integer Underflow

Q: What input is required to trigger the issue?

An attacker would need to provide a malformed Pha format tracker module packaged in a .mod file and have it processed by the affected Libxmp depacker.

Q: Is exploitation likely to be remote by default?

The supplied CVSS vector lists local attack vector and high attack complexity. The available data does not indicate that merely running a default network-exposed service is affected.

Q: Which versions are known to be affected?

Libxmp through version 4.6.2 is identified as affected.

Published May 6, 2025

Updated

Libxmp through 4.6.2 has a stack-based buffer overflow in depackpha in loaders/prowizard/pha.c via a malformed Pha format tracker module in a .mod file.

Affected Software

1 affected component

Libxmp Libxmp<=4.6.2

Event History

May 6, 2025

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:15 PM

DescriptionSeverityWeakness

Apr 16, 57340

Event

via FIRST·02:29 AM

Frequently Asked Questions

What input is required to trigger the issue?

An attacker would need to provide a malformed Pha format tracker module packaged in a .mod file and have it processed by the affected Libxmp depacker.

Is exploitation likely to be remote by default?

The supplied CVSS vector lists local attack vector and high attack complexity. The available data does not indicate that merely running a default network-exposed service is affected.

Which versions are known to be affected?

Libxmp through version 4.6.2 is identified as affected.

CVE-2025-47256: Integer Underflow

Affected Software

Event History

Frequently Asked Questions

What input is required to trigger the issue?

Is exploitation likely to be remote by default?

Which versions are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What input is required to trigger the issue?

Is exploitation likely to be remote by default?

Which versions are known to be affected?